Systems, methods and devices for secure routing and recording of network data transported through network switch
AssigneeOvsecure Ltd.
InventorOleg Vaisband
Life of this patent
Estimating the term…
Abstract
The disclosure relates to systems, methods and devices for secure routing and recording of network data streams passing through a network switch. Specifically, the disclosure relates to systems, methods and devices for reversibly deconstructing networks' OSI L1-L7 in time and space, in the process of selectively recording network data streams for secure access, as well as providing external rule-based security auditing and functioning as a black-box in industry-specific applications.
Claims33
A system for secure local area network (LAN) routing and data recording comprising:
- a. a security audit module included in a secure hardware module, executed by the communication processor, the security audit module being in communication with a network switch, configured for conducting periodical security audit;
- b. a non-volatile memory module in two-way communication with the communication processor;
- and
- c. a central processor coupled to a transceiver, the central processor having thereon a processor-readable medium coupled to a non-volatile memory storage device having thereon a set of executable instructions configured to, when executed, to cause the processor included in the central processor to:
- i. transmit and receive data stream from the communication processor via an internal management port;
- ii. based on predetermined criteria, rout the network data stream or portions thereof to the communication processor via a data conduit;
- iii. using the communication processor, process the network data stream or portion thereof to record the network data stream;
- iv. using established, port specific rules, selectively block the network data stream or portions thereof;
- v. using the security audit module, review the established rules at a predetermined period;
- vi. using the security audit module, review at least one of:
- the transported network data not blocked, and the blocked network data at any given network layer;
- vii. make changes to the port-specific rules for selectively blocking the network data stream or portions thereof;
- viii. using an encryption/decryption accelerator module included in the system, decrypt the encrypted network data stream or portion thereof;
- ix. analyze the decrypted data stream or portion thereof, based on the established port-specific rules;
- x. when detect that the decrypted data stream or portion thereof, meets the established port-specific rules;
- xi. encrypt the decrypted data stream or portion thereof;
- and
- xii. store the encrypted data stream or portion thereof on the non-volatile memory storage device;
- wherein the secure hardware module is adapted to provide a selectably reversible temporospatial disconnect among the network's OSI:
- data link layer, and/or network layer, and/or transport layer, and/or application layer and/or a combination of the foregoing.
A method for secure routing and recording of local area network (LAN) data stream passing through a network switch implementable in a computerized system comprising a security audit module in communication with at least one of a communication processing module and a network switch, each included in the system, the security audit module configured for conducting periodical security audit, a non-volatile memory module in two way communication with the communication processing module, and a central processing unit coupled to a transceiver, the central processing unit having thereon a processor-readable medium coupled to a non-volatile memory storage device having thereon a set of executable instructions configured to transmit and receive data from the communication processing module, wherein the secure hardware module is adapted to provide a selectably reversible, temporospatial disconnect among the network's OSI:
- data link layer, and/or network layer, and/or transport layer, and/or application layer and/or a combination of the foregoing, the method comprising
- a. receiving a network data stream through the network ports to the network switch;
- b. based on predetermined criteria, routing the network data stream or portions thereof to the communication processing module via a data conduit;
- c. using the communication processing module, processing the network data stream or portion thereof thereby recording the network data stream;
- d. using the security audit module and based on established rules, selectively blocking the network data stream(s);
- e. using the security audit module, periodically reviewing the established rules;
- f. using the security audit module, review at least one of:
- the transported network data not blocked, and the blocked network data at any given network layer;
- g. using an encryption/decryption accelerator module included in the system, decrypting the encrypted network data stream or portion thereof;
- h. analyze the decrypted data stream or portion thereof, based on the established port-specific rules;
- i. upon detecting that the decrypted data stream or portion thereof, meets the established port-specific rules, encrypting the decrypted data stream or portion thereof;
- and
- j. storing the encrypted data stream or portion thereof on the non-volatile memory storage device.
An apparatus for providing secure routing and recording of a network data stream passing through a local area network (LAN) switch, the apparatus comprising:
- a security audit module in communication with at least one of a communication processing module and a network switch, each included in the apparatus, configured for conducting periodical security audit, and the communication processor in communication with a non-volatile memory having thereon a processor-readable firmware, the communication processor and circuitry adapted to provide a selectably reversible, temporospatial disconnect among the network's OSI:
- data link layer, and/or network layer, and/or transport layer, and/or application layer and/or a combination of the foregoing, wherein the processor-readable firmware comprises a set of executable instructions configured, when executed, to cause the communication processor to:
- a. transmit and receive data stream from the communication processing module via an internal management port;
- b. based on predetermined criteria, rout the network data stream or portions thereof to the communication processing module via a data conduit;
- c. using the communication processing module, process the network data stream or portion thereof to record the network data stream;
- d. using established, port specific rules, selectively block the network data stream or portions thereof;
- e. using the security audit module, review the established rules at a predetermined period;
- f. using the security audit module, review at least one of:
- the transported network data not blocked, and the blocked network data at any given network layer;
- g. make changes to the port-specific rules for selectively blocking the network data stream or portions thereof;
- h. using an encryption/decryption accelerator module included in the system, decrypt the encrypted network data stream or portion thereof;
- i. analyze the decrypted data stream or portion thereof, based on the established port-specific rules;
- j. when detect that the decrypted data stream or portion thereof, meets the established port-specific rules;
- k. encrypt the decrypted data stream or portion thereof;
- and
- l. store the encrypted data stream or portion thereof on the non-volatile memory storage device.
Dependencies are inferred from the claim text.